Trustswiftly Helps Organizations Meet NIST 800-63-4 IAL3 Compliance
Identity ecosystems are increasingly subject to regulatory, security and customer experience demands. NIST SP 800-63-4 redefines assurance to facilitate a risk-based approach throughout the identity lifecycle.
IAL3 requires on-site attended sessions with CSP representatives and collection of one or more biometrics from individuals in order to safeguard highly scalable attacks while protecting sensitive data.
What is nist 800-63-4 ial3 compliance?
The NIST Digital Identity Guidelines have defined three assurance levels to indicate how certain an online identity corresponds with its real-world counterpart, from self-asserted (IAL1) to in-person verification (IAL3). Relying parties can use these assurance levels when making risk decisions when assessing assertions from identity providers, and make informed decisions on appropriate steps they need to take as a result of those assessments.
IALs use multiple factors to verify a claimant’s identity, such as documents and biometrics. For IAL2 and IAL3 authentication, authentication factors must be capable of withstanding both replay attacks as well as spoofing attacks; the first and second IAL requirements mandate phishing-resistant MFA while for the third one CSP representatives will verify an individual in person – marking a clear strategic shift away from passwords and SMS OTPs.
Zero Trust meets these nist 800-63-4 ial3 compliance requirements by using adaptive MFA, which automatically adapts its security posture in response to risk conditions, making identity assurance a continuous model rather than point-in-time check. Our comprehensive passwordless and multi-factor authentication platform, HYPR Affirm, supports both IAL2 and IAL3 compliance through document verification, biometrics, chat video telephony facial recognition liveness detection step up reproofing based on risk. This move from static checkbox security posture reduction reduces cybersecurity insurance premiums reduce attack surface as well as creating more resilient digital environments.
What is Trustswiftly nist 800-63-4 ial3 software?
ial3 identity verification software involves verifying a user’s claims to verify his or her true name, address or other data. Authentication ensures that claimants actually own one or more authenticators while Federation allows the exchange of attributes between an Identity Provider (IdP) and Requestors (RPs). These guidelines aim to complement federal information security requirements set out in FISMA [Federal Information Security Management Act] and NIST RMF [NIST Risk Management Framework].
Identity fraud and breaches can cause irreparable harm to both individuals and organizations, from an inability to complete critical mission/business functions in a timely or correct manner, within planned resource constraints, as well as loss of existing trust relationships.
Impacted entities include individuals and communities affected by online services that fail to perform as expected or become compromised, leading to impacts ranging from minor inconveniences to widespread disruptions and damage. To mitigate risks related to these failures, these guidelines provide guidance for redress processes that are transparent, user-friendly, resistant to attacks, and capable of responding appropriately when an unintended or intentional failure arises.
This version strengthens measures to combat these threats by repurposing IAL1 as a new assurance level, updating authentication risk and threat models to account for recent attacks, providing more options for phishing-resistant authentication, introducing requirements that prevent automated attacks against enrollment processes, and planning for emerging technologies (e.g. mobile driver’s licenses and verifiable credentials) which provide strong fedramp high identity proofing and authentication solutions. In addition, organizations SHOULD monitor certain metrics as part of their continuous evaluation programs – these metrics depend on which technologies, architectures or deployment choices an organization makes.
What is Trustswiftly nist 800-63-4 ial3 support?
Identity, Authentication and Federation Assurance Levels (IAL, AAL and FAL) in these guidelines are intended to complement and supplement controls and requirements established under federal cybersecurity policies such as NIST Risk Management Framework (RMF). They do not aim to replace or modify information and systems controls determined through such processes.
IAL1: Authentication that relies on basic confidence that the claimant possesses control of an authenticator tied to their subscriber account, such as PIV cards or USB tokens. Multi-factor authenticators such as PIV cards or USB tokens, biometric characteristics like fingerprints or iris patterns, biometric characteristics (fingerprints/iris patterns etc) as well as biometric signatures are accepted as authenticators but must be combined with something physical such as password or physical token; knowledge-based authentication (KBA), such as questions asked by IdP/KBA or challenge questions is not considered authenticators.
AAL2: Authentication that demands high confidence that the claimant controls one or more authenticators bound to their subscriber account, including multiple-factor authentication via multiple technologies. CSPs typically create subscriber accounts to record information about subscribers and any authenticators that they choose to bind, also known as an attribute bundle, that are passed along when authenticating with RPs at authentication time.
AAL3 federation assurance level emphasizes the robustness of processes used to communicate authentication and attribute information from an IdP to RP, such as using authentication/authorization protocols or mechanisms that ensure authenticators are backed by trusted public keys. A CSP sets up a wallet for its subscribers which contains verification keys as well as private keys which correspond with each subscriber account.
What is Trustswiftly nist 800-63-4 ial3 pricing?
Security risks posed by breaches can be substantial and the consequences for organizations can be disastrous. Identity fraud often plays a pivotal role in these breaches, with credentials compromised and used to gain entry to online services and systems. A holistic approach to digital identity assurance that creates trust in user’s real life existence through three layers of identity assurance as outlined in NIST Special Publication 800-63: Identity Proofing, Authentication and Federation provides one solution to this problem.
Reaching the highest level of assurance – IAL3 – requires stringent verification standards, such as attending a session with a CSP representative and biometric collection; stringent chain of custody protection; and anti-spoofing features. Such rigorous oversight is often essential when operating high risk applications like critical infrastructure and government services.
Acing IAL3 requirements can be a difficult challenge for businesses that do not possess the hardware, staff or expertise to oversee this process. Trustswiftly’s software-anchored nist ial3 verification platform makes complying with this level of compliance cost-effective while simultaneously decreasing attack surfaces, cyber liability insurance premiums and operational expenses through reduced password reset requests.
Trust Swiftly helps businesses ensure compliance with IAL3 requirements by using managed retention schedules and remote identity verification agents to demonstrate assurance quickly, with minimum disruption for genuine users.
